Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/16—Implementing security features at a particular protocol layer
  • H04L63/162—Implementing security features at a particular protocol layer at the data link layer
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
  • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/03—Protecting confidentiality, e.g. by encryption
  • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic

Definitions

• a wireless access point In a conventional wireless network, communication between a wireless access point and a computing device (e.g., a switch) attached thereto by a wired connection is inherently insecure. That is, a signal transmitted via the wired connection is unencrypted, and therefore capable of being intercepted. An unauthorized user can intercept the signal and access data contained therein by employing sniffing, spoofing, and other techniques.
• a computing device e.g., a switch
• IPsec Internet Protocol Security
• IPsec Internet Protocol Security
• the present invention relates to a system including a wireless access point and a computing device.
• the wireless access point has a first wireless protocol and communicates with a wireless device which has a second wireless protocol.
• the access point and the wireless device are configured to conduct wireless communications using the first and second wireless protocols.
• the computing device has a third wireless protocol and is coupled, via a wire, to the access point. The computing device conducts communications with at least one of the access point and the wireless device using the third wireless protocol.
• FIG. 1 shows an exemplary embodiment of a system according to the present invention
• Fig. 2 shows an exemplary embodiment of a computing device according to the present invention
• Fig. 3 shows an exemplary embodiment of a method of communication from an access point to a computing device according to the present invention
• Fig. 4 shows an exemplary embodiment of a method of communication from a computing device to an access point according to the present invention.
• the present invention may be further understood with reference to the following description and the appended drawings, wherein like elements are referred to with the same reference numerals .
• the exemplary embodiment of the present invention describes a system and a method for communication in a wireless network containing one or more wireless access points and one or more computing devices attached thereto via one or more wire connections.
• the present invention further describes a computing device which supports communication according to the system of the present invention.
• Fig. 1 shows an exemplary embodiment of a system 1 according to the present invention.
• the system 1 may include one or more wireless devices (e.g., a mobile unit "MU" 10) in wireless communication with one or more access points ("APs") 20, 22, 24.
• the wireless communication between the MU 10 and the AP 20 may be conducted according to a predefined communication protocol, such as, for example, an IEEE 802. Hx standard.
• the MU 10 is capable of communicating with each of the APs 20-24, but may associate, and thus communicate, with only one AP (e.g., the AP 20) for a predetermined time and/or until a predetermined condition occurs (e.g., roaming out of a range of the AP 20) .
• the AP 20 may have an architecture including a processor, one or more antennas, one or more transmitters, and one or more receivers.
• Fig. 1 shows only the MU 10 in wireless communication with the AP 20
• the system 1 may include any number and type of MUs (e.g., PDAs, cell phones, scanners, laptops, handheld computers, etc.).
• the MU 10 may include a non-mobile unit attached to the wireless device (e.g., a PC or a laptop with a network interface card) .
• Each AP 20-24 may be connected to one or more computing devices (e.g., a switch 30) via a wired connection.
• the system 1 of the present invention may be utilized by any computing device which is connected, either directly or indirectly, to one or more of the APs 20-24, via the wired connection.
• the switch 30 may be further connected to one or more data devices (e.g., a server 40) which are connected to a communications network 60 (e.g., an Internet, a WLAN).
• a communications network 60 e.g., an Internet, a WLAN.
• the server 40 is connected directly to the Communications network 60, while in another embodiment the server 40 is connected to the communications network 60 via a router 50.
• the APs 20-24, the MU 10, the switch 30, and the server 40 may comprise a network.
• the teachings of the present invention can be extended to any AP in the system 1.
• the router 50 directs a path of a transmission when communicated between two or more networks connected thereto.
• the router 50 directs the path of the transmissions from the server 40 and the communications network 60.
• the router 50 determines a destination of the transmission and directs the transmission thereto.
• the router 50 may, for example, direct transmissions intended to remain within a network of the server 40, or alternatively, the router 50 may direct transmissions intended to pass from the network of server 40 to the communications network 60, and vice- versa.
• the server 40 may communicate with the AP 20 and/or the MU 10 via the switch 30 and/or to the communications network 60 via the router 50.
• the server 40 may fulfill an intra-network request.
• the MU 10 may request a data value from the server 40.
• the server 40 may also fulfill an inter-network request.
• the server 40 receives the request from the communications network 60 via the router 50.
• Radio frequency (“RF”) signals may be communicated between the MU 10 and the AP 20 over a preselected radio channel.
• the communications may be encrypted by a processor or a dedicated circuit (e.g., an encryption circuit) in either using a wireless encryption protocol (e.g., a Wired Equivalent Privacy (“WEP”), wi-fi protected access (“WPA”), WPA2, AES-CCMP/802. Hi) prior to transmission.
• WEP Wired Equivalent Privacy
• WPA wi-fi protected access
• WPA2 Wired Equivalent Privacy
• WPA2 Wired Equivalent Privacy
• WPA2 Wired Equivalent Privacy
• WPA2 Wired Equivalent Privacy
• WPA2 Wired Equivalent Privacy
• AES-CCMP/802. Hi Wired Equivalent Privacy
• the wireless encryption protocol may be a software application executed by the processor or may be hardwired on the dedicated circuit.
• the MU 10 encrypts the communication prior to transmission to the AP 20.
• the AP 20 may conduct a similar process when transmitting a further communication to the MU 10.
• the AP 20 decrypts the communication using a built-in wireless encryption protocol (e.g., the WEP), and creates a frame (e.g., a control frame or a data frame) which is transmitted to the switch 30 via the wired connection therebetween.
• the frame may be unencrypted and may be, for example, a configuration, a heartbeat, a status and/or a statistic frame.
• the built-in wireless encryption protocol provides the AP 20 with a capability to encrypt the communications transmitted to the MU 10.
• the wireless encryption protocol and the built-in wireless encryption protocol are similar in that they provide for decryption of encrypted transmissions between the MU 10 and the AP 20.
• the AP 20 After the AP 20 receives the communication from the MU 10, the frame is transmitted to the switch 30 via the wired connection thereto.
• the AP 20 would decrypt the frame, and optionally re-encrypt the frame using an IPsec protocol, before transmitting it to the switch 30.
• the AP 20 and the switch 30 may encrypt and decrypt the frames communicated therebetween utilizing a wireless encryption protocol.
• the switch 30 may include a memory arrangement 60, a network communication arrangement ("NCA") 62, and a processor 64.
• the memory 60 may be any storage device capable of having data written thereto and read therefrom. Examples of the memory arrangement include, but are not limited to, SRAM, EPROM, ROM, and other similar arrangements.
• the memory 60 may be a combination of both a volatile and a non-volatile memory.
• the memory 60 may include one or more stored wireless encryption protocols. According to the present invention, the stored wireless encryption protocol is compatible with the wireless encryption protocol utilized by the AP 20.
• the NCA 62 provides for communication between the AP 20 and the switch 30 via the wired connection.
• the NCA 62 may further allow for communication between the switch 30 and, for example, the server 40.
• the NCA 62 may be a hardware configuration which would provide for the communicative abilities of the switch 30.
• the hardware configuration may be one or more ports (e.g., serial, parallel, USB, etc.) which receives the wired connection from the AP 20 and, optionally, the server 40.
• the switch 30 may be connected to each AP 20-24 and the server 40 via the NCA 62.
• the processor 64 controls communication between the switch 30 and any device connected thereto.
• the processor 64 may be a microcontroller, application-specific integrated circuit, or other hardware configuration capable of processing data and accessing applications and/or data stored in the memory 60.
• the processor 64 directs a path of a transmission between two or more devices connected to the switch 30.
• the processor 64 may establish a connection between the AP 20 and the server 40 when, for example, the communication received by the AP 20 from the MU 10 is addressed for the server 40.
• the processor 64 may also encrypt and decrypt a transmission received by the switch 30.
• the processor 64 may access the memory 60 and execute an encryption or decryption procedure utilized by the stored wireless encryption protocol stored therein. This process will be described in more detail below.
• Fig. 3 shows an exemplary embodiment of a method 300 according to the present invention.
• the method 300 generally describes communication between the AP 20 and the switch 30, and in particular, a transmission from the AP 20 to the switch 30.
• a network event is detected by the AP 20.
• the network, event may include, but is not limited to, detection of the MU 10 within a coverage area of the AP 20, loss of communication between the AP 20 and the MU 10, and receiving the communication from the MU 10.
• the network event may cause or require an adjustment of a setting on the MU 10, the AP 20, the switch 30 and/or the server 40.
• Examples of the adjustment include, but are not limited to, changing the power level of the AP 20, transferring communication with the MU 10 to a further AP (e.g., AP 22), and specifying the preselected radio channel for use by the MU 10 and the AP 20.
• the AP 20 may generate and transmit one or more frames to the server 40 and/or the switch 30. For example, if the MU 10 is moving away from the AP 20 towards the AP 22, the AP 20 may detect a change in a characteristic (e.g., signal strength) of the signal from the MU 10 and transmit this information to the server 40 and/or the switch 30.
• a characteristic e.g., signal strength
• the network event include when the AP 20 collects one or more statistics which it may transmit to the switch 30 at predetermined intervals, and when the MU 10 attempts to authenticate itself to the switch 40 and generate a session key for encryption.
• the switch 40 may transmit the session key(s) to the AP 20 allowing it to encrypt/decrypt communications from the MU 10.
• the frame is encrypted by the AP 20 using the built-in wireless encryption protocol.
• the AP 20 decrypts the communication received from the MU 10 and then generates and encrypts the frame using the built-in wireless encryption protocol.
• the AP 20 generates the frame based on the network event, independent of communication with the MU 10.
• the built-in wireless encryption protocol used in this step may be any wireless encryption protocol (e.g., WEP, Wi- Fi Protected Access (“WPA”), WPA2, Advanced Encryption Standard - Counter Mode CBC-MAC Protocol (“AES-CCMP”) /802. Hi, etc.) utilized for encryption/decryption by the AP 20 during wireless communication.
• WEP Wi- Fi Protected Access
• WPA2 Wi- Fi Protected Access
• AES-CCMP Advanced Encryption Standard - Counter Mode CBC-MAC Protocol
• step 306 the encrypted frame is transmitted by the AP 20 to the switch 30 via the wired connection.
• the frame includes the communication from the MU 10 or is generated by the AP 20, the frame will be addressed to the switch 40.
• step 308 the switch 30 decrypts the frame using the stored wireless encryption protocol in the memory 60.
• the stored wireless encryption protocol of the switch 30, the wireless encryption protocol of the MU 10 and the built-in wireless encryption protocol of the AP 20 are functionally equivalent in that the frame may be encrypted and decrypted by each of the switch 30, the MU 10 and the AP 20.
• the switch 30 processes the frame. That is, the frame may include information which requires a response from a receiver thereof. For example, if the MU 10 remains within the range of the AP 20 and signals received from the AP 22 are weaker than those from the AP 20, the switch 30 may instruct the AP 20 to increase a power level to maintain and/or facilitate communication with the MU 10. As stated above, the transmitted by the AP 20 to the switch may be the control and/or data frame
• Fig. 4 shows an exemplary embodiment of a method 400 according to the present invention.
• the method 400 generally describes communications between the AP 10 and the switch 30, and in particular, a transmission from the switch 30 to the AP 20.
• the switch 30 encrypts the frame from the server 40 using the stored wireless encryption protocol.
• the frame may include an instruction from, for example, the server 40.
• the instruction may be embodied as one or more control frames and/or one or more data frames.
• the server 40 may instruct the AP 20 to adjust the power level thereof.
• the switch 30 may generate and encrypt a frame originating therefrom.
• step 404 the encrypted frame is transmitted to the AP 20 via the wired connection.
• the AP 20 decrypts the frame using the built-in wireless encryption protocol.
• the AP 20 processes the frame. For example, the AP 20 recognizes the instruction in the frame which requires the AP 20 to increase the power level. Thus, the AP 20 performs a predetermined action (e.g., boosts the power level) in response to the instruction.
• a predetermined action e.g., boosts the power level
• a further advantage of the system 1 according to the present invention relates to a multicast (e.g., the server 40 needs to transmit the same instruction to each of the APs 20-24) .
• the APs 20-24 have a unique security key for a unicast frame and a shared broadcast key for a multicast frame.
• the multicast frame originating at the server 40 is transmitted to the switch 30.
• the multicast frame may originate at the switch 30.
• the switch 30 encrypts the multicast frame using the shared broadcast key and transmits the multicast frame to each of the APs 20,22,24.
• Each AP 20,22,24 decrypts the multicast frame using the shared broadcast key and independently processes the information (e.g., the instruction) therein.
• the data is encrypted only once before being transmitted to each of the APs 20,22,24.
• the system 1 may be applied to any wired communication between the APs 20,22,24 and the switch 30.
• the system 1 may be applied, for example, to key exchanges and authentication between the MU 10 and the server 40.
• the AP 20 includes built-in wireless security protocols in addition to the built-in wireless encryption protocol.
• the protocols include authentication protocols and key management protocols, such as those built into the IEEE 802. IX standards.
• the MU 10 may be authenticated prior to communication in the system 5.
• the server 40 may initiate a key exchange procedure according to the key management protocol by transmitting a session key to the switch 30, which encrypts and transmits the session key to the AP 20 in accordance with the key management protocol.
• the AP 20 uses the session key to create a key message in accordance with the key management protocol, and transmits the key message to the MU 10, which uses the key message to create an encryption key.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Mobile Radio Communication Systems (AREA)

Priority Applications (2)

Applications Claiming Priority (2)

Publications (1)

Family

ID=36739903

Family Applications (1)

Country Status (5)

Families Citing this family (65)

Citations (5)

Family Cites Families (5)

• 2005
  • 2005-04-20 US US11/110,015 patent/US20060251255A1/en not_active Abandoned
• 2006
  • 2006-04-11 EP EP06740943A patent/EP1872559A1/de not_active Withdrawn
  • 2006-04-11 CN CNA2006800134739A patent/CN101164315A/zh active Pending
  • 2006-04-11 CA CA002604843A patent/CA2604843A1/en not_active Abandoned
  • 2006-04-11 WO PCT/US2006/013950 patent/WO2006115814A1/en active Application Filing

Patent Citations (5)

Also Published As

Similar Documents

Legal Events